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Introduction. In the current situation, the interest of business owners and managers in the effective and 
reliable operation of internal control is growing. An internal control system is a set of organizational measures, 
methods, and procedures used by an entity's management to conduct business in an orderly and efficient 
manner, to ensure the safety of assets, and to prevent data breaches. A broad interpretation of the goals and 
objectives of the control functions of management, the diversity of existing forms of organization of the 
internal control service in practice determines the complexity of developing an optimal structure of criteria for 
assessing the effectiveness of the internal control system. 

Methods for assessing the effectiveness of the internal control system in the audit of financial 
statements are based on the application of auditing procedures provided for in international auditing standards. 
One of the ways to improve the internal control system is a process approach to management. Insufficient 
formalization of the internal control process, the lack of corporate standards and regulations do not allow to 
address the organizational and methodological issues of the implementation of the control function in the 
management environment. 
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The issues of the system of internal control in business entities are widely covered in normative-legal 
documents and in the works of economists. In particular, according to Article 21 of the Law of the Republic of 
Uzbekistan "On Accounting", the internal control is a system of measures established on the basis of the 
accounting policy adopted by the head of the accounting entity for the purpose of prevention and detection ”[1]. 

In accordance with the International Standard on Auditing No. 315 "Identification and assessment of the 
risks of material misstatement on the basis of knowledge of the business entity and its environment" a process 
that is developed, implemented, and maintained by the individuals, management, and other personnel charged 
with management [3]. 

According to A.Avlokulov, Doctor of Economics, the purpose of assessing the system of internal 
control is to correctly determine the time and scope of the audit. By evaluating the internal control system 
itself, the client business performance inspection program can be correctly identified. In addition, by evaluating 
the internal control system, the audit firm can advise the client on its regulation and improvement in the 
enterprise [4]. 

According to another group of economists, a well-established system of internal control helps to 
identify errors and shortcomings in the organization in a timely manner and help it to work effectively [5]. 

Some scholars have noted: “Accurate assessment of the effectiveness of the internal control system 
plays an important role in the audit of financial statements. International auditing standards also pay close 
attention to the issues of internal control system in the quality of audits ”[7]. 

Economists V. Lakis and L. Giriunas say that in modern economic conditions, one of the most 
important tools for enterprise management is an effective system of internal control, which serves to create 
priorities for success among competing enterprises [8]. 

D.Dimitrievich, V.Milovanovich, V.Stanchich concluded that the system of internal control is a set of 
actions that control the effectiveness of the company and serves to ensure the achievement of its goals [6]. 

From the above considerations, it can be seen that a lot of research has been done on the internal control 
system. However, most studies do not pay enough attention to the factors influencing the organization of the 
internal control system and research on reducing audit risk in this process. 


ANALYSIS AND RESULTS 

When conducting an audit of financial statements, the auditor should have knowledge of the internal 
control system required to conduct the audit. The auditor uses this knowledge to determine the potential 
misstatement of the financial statements, as well as to plan the nature, timing and scope of the audit. 

The auditor shall identify and assess the activities of the audited entity and the environment in which it 
is performed, including the internal control system, the risk of material misstatement of the financial statements 
as a result of errors or misconduct by the audited entity's management or employees; should learn enough. 
Similar requirements are set out in international auditing standards. These requirements are governed by IAS 
315, Identifying and Assessing the Risks of Significant Violations Based on Knowledge of the Business Entity 
and its Environment. The purpose of the auditor's assessment of the internal control system in the audit of 
financial statements is to identify the risks of material misstatement in the financial statements and to carefully 
plan and conduct an audit. 

It is known that understanding the internal control system is of great importance in conducting financial 
audit. In particular, this concept provides a basis for assessing the risk of serious misstatement of audit planning 
and financial statements and for expressing the auditor's professional views on responding to these risks in the 
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audit, for example: 

- to determine the level of materiality in the inspection process and assess whether the decision on it 
remains unchanged; 

- reviewing the appropriateness of the selection and application of accounting policies and the 
transparency of information in the financial statements; 

- identification of the object of the audit, which requires special attention of the auditor, in particular, 
the relationship with the parties, the continuity of the organization or the assumptions of management to study 
the objectives of business operations; 

- planning and implementation of subsequent audit activities in order to minimize audit risk; 

- assessment of the appropriateness and appropriateness of the audit evidence obtained, as well as oral 
and written information and explanations of the management of the audited entity. 

Figure 1 shows the responsibilities of the external auditor in assessing the effectiveness of controls 
established by the International Standard on Auditing No. 315, "Identification and assessment of the risks of 
material misstatement on the basis of knowledge of the business entity and its environment." 


HazopaT BocuTaslapu MOCJIYTHHA 
Gaxonan 


HasoparT BocuTalapy KÝIJAHAINHHH 
aHHKJIAIN 


HaraxanapHn XyxxAaTIAMTHpHN 


Figure 1. On evaluating the effectiveness of controls 
obligations of the external auditor ! 

The organization’s control tools include reviewing its ability to prevent or detect and correct significant 
violations. The auditor should evaluate whether the risk of material misstatement of the financial statements 
can be reduced or prevented. 

In our view, the auditor should determine the status of the use of controls across the five components of 
the internal control system: the control environment; the process of risk assessment of the inspected person; 
information system related to the preparation of financial statements; control procedures; monitoring of control 


means. The elements of the control environment to be evaluated by the external auditor are shown in 
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Figure 2. 

The external auditor evaluates the effectiveness of the elements of the control environment by obtaining 
audit evidence. In gathering audit evidence, the auditor may use the following actions: control, inspection, 
inquiry, calculation, analytical actions, external confirmation, re-examination. The model of assessment of 
elements of the control environment by the external auditor shows that the auditor obtains relevant audit 
evidence on the use of elements of the control environment by combining inquiries and other risk assessment 
activities, monitoring or reviewing documents. 


Communicate the principle of 

honesty, other ethical values to 

employees and ensure that they Participation of Management style of work 
are followed representatives of the owner 


Elements of the control environment that the auditor should evaluate in a financial statement 
audit 


Separation of Personnel policy and practice 


responsibilities and powers 


Organizational structure 


Figure 2. Elements of the control environment that the auditor should evaluate in a financial statement 
audit’ 


— It should be noted that International Auditing Standard No. 315 instructs the auditor to gain an understanding 
of the control environment, with particular emphasis on the risk of fraud. According to ISA 240, “Auditor's 
Liability for Financial Statement Audit Fraud,” fraud is an intentional act by one or more individuals to 
obtain unfair or unlawful gain from management, management, employees, or third parties [2] . Fraud in the 
accounting system is characterized by intentional acts or omissions related to the misstatement of financial 
statements. In assessing the internal control system, the auditor should conduct audits to obtain the 
information necessary to determine the risk of serious misstatement as a result of dishonest actions. The 
auditor should ask the management of the audited entity the following questions: 


— - the situation in which the financial statements of the audited entity are seriously distorted as a result of 
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dishonest actions; 


— - the process carried out by the management of the audited entity to identify and respond to the risk of 
dishonest actions; 

— - Interaction between management and representatives of the audited entity in the process of identifying risks 
arising from dishonest actions and taking measures against such risks; 

— - Interaction between the management and employees of the enterprise being audited from the point of view 
of management on the rules of conduct and ethical standards of employees. 

It should be noted that the existence of a satisfactory control environment is a positive factor in the auditor's 

assessment of the risk of serious misrepresentation of information and may affect the nature, timing and extent 

of subsequent actions. In particular, this may indicate a reduction in the risk of dishonest behavior. However, 

deficiencies in the control environment can impair the effectiveness of control tools. 

The auditor must then determine the status of the use of management in the process of risk assessment by the 

audited entity, the second component of the internal control system. In assessing the organization and 

application of the risk assessment process, the auditor determines how the management of the entity being 

audited is to be performed. 

The external auditor sends inquiries to the management of the audited entity about the risks of the 
business and considers these risks in terms of whether they can lead to serious misrepresentation of information. 
During the audit, the auditor may identify the risk of serious misstatement of information that management 
cannot identify. In such cases, the auditor determines whether the risk is primarily a risk that needs to be 
identified by the audited entity in the risk assessment process and, if so, why it is not. If the auditor concludes 
that there are significant deficiencies in the risk assessment process by the audited entity, the auditor will 
contact the property owners' representatives. 

It is well known that analytical activities can help identify indicators and trends that may reflect 
unconventional transactions or events, as well as problems with financial reporting and auditing. When 
performing analytical activities as risk assessment activities, the auditor evaluates the expected performance 
indicators. If the comparison of the expected results with those calculated on the basis of recorded amounts or 
calculated amounts leads to normal or unexpected results, the auditor takes these results into account in 
determining the risk of material misstatement. Monitoring and control is the basis for sending inquiries to the 
management and other employees of the audited entity, as well as a source of information on the risk assessment 
process by the audited entity. Such audits typically include: 

- monitoring the operations and various areas of activity of the audited entity; 

- control of internal control system regulations and accounts; 

- study of reports; 

- monitoring the reflection of business transactions in information systems that generate data for 
financial reporting. 

The elements of the information systems to be evaluated by the auditor are shown in Figure 4. 

In the review process, the auditor reviews the steps used to transfer data from transaction processing 
systems to the General Ledger or the financial reporting system. 

Transaction processing systems and financial reporting systems are systems of manual or automated 
registration, processing and generalization of information on business operations. The auditor should also 
review the procedures for collecting information related to financial statements of events and events not related 
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to the entity's business, such as the depreciation or impairment of assets or accounts receivable. 

The auditor should understand the operation of the audited entity's information systems related to the 
preparation and preparation of the financial statements in order to conclude that the audited entity is compliant 
with the operating conditions. 


¢The same groups of transactions that are important for financial reporting 


*Procedures for recording, processing and reporting business transactions 


*Certain items of financial statements related to accounting records, registration, processing 
and summarization of business transactions 


¢Information about events and events that do not fall into the same type of transactions but may 
be significant to the financial statements 


The process of preparing and preparing financial statements 


Figure 4. Elements of information systems that the auditor should evaluate in a financial statement 
audit? 


Monitoring and control of the processes of registration, processing and generalization of business 
operations can be the basis for assessing the reliability of information systems of the audited entity. Responses 
to inquiries sent to employees involved in performing or reporting complex or unusual transactions in 
accounting will help the auditor assess the appropriateness of selecting and applying some of the accounting 
firm’s accounting rules. 

The auditor should have sufficient knowledge of the audited entity's controls to assess the risk of 
material misstatement at the level required for the preparation of the financial statements and develop follow-up 
audit procedures to assess the assessed risks. Control actions include the actions taken by the audited entity to 
ensure that the control activities are performed and that the necessary measures are taken against the risks that 
may prevent the audited objectives from being achieved. Controlled actions of the inspected entity, performed 
manually or using information systems, have different purposes and are applied at different organizational and 
functional levels. 

The control procedures to be performed by the external auditor are shown in Figure 5. 
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e Authorization of the audited entity to allow control activities 
*Checking the implementation of control procedures 


*Checking the implementation of control procedures 


*Checking the availability and condition of the assets of the audited entity 


Distribution of responsibilities among the employees of the person being inspected during 
control activities 


5- picture. Control procedures to be evaluated by the auditor in the audit of financial statements 4 

By familiarizing themselves with the control activities of the audited entity, the auditor will primarily 
prevent or detect serious irregularities in the operations groups, balance sheets, or specific circumstances. 

The auditor should identify the main activities performed by the audited entity to evaluate the system 
of internal control over financial statements. The auditor should identify what the source of information is for 
the monitoring measures and, on that basis, the circumstances that management considers sufficient to achieve 
the relevant objectives. Monitoring activities involve internal auditors or staff performing similar functions for 
many audit entities. 

In actions in the field of monitoring, the management of the audited entity may use external 
information. If the auditor intends to use the information generated for the process by the audited entity for the 
purposes of the audit, in particular the reports of the internal auditor, the auditor should determine whether the 
information is sufficiently detailed or reliable for use. 

Thus, during the study, elements of the internal control system components that the auditor should 
examine were identified to assess the effectiveness of the controls. Paying special attention to these elements 
in audits allows to identify the risk of serious misstatements in the financial statements and to plan the audit 
prudently.. 


CONCLUSION 
1. In order to achieve their goals, business entities must properly organize their activities and 
exercise constant control over them. Therefore, the issues of organization of the system of internal 
control in business entities are widely considered in scientific research. In our opinion, the effective 
implementation of the internal control system requires the widespread use of advanced scientific 
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achievements and innovative technologies. 

2. In the careful planning and consistent implementation of audits, auditors pay close attention to 
assessing the effectiveness of the internal control system. An objective assessment of the internal 
control system allows for the correct determination of materiality and risk levels and the optimal 
determination of the scope of audit selection. 

3. The quality of the work of audit organizations depends on their correct determination of audit risk. 
Audit risk has a special place in the structure of control risk, the level of which depends directly on 
the state of the internal control system in business entities. As a result of the research, the application 
of the above recommendations for the assessment of the internal control system will allow to 
determine the optimal level of audit risk. 
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